Cryptomator

Send Command

Support for client-side encryption with Cryptomator interoperable Vaults to secure your data on any server or cloud storage.

Send Command

The client-side encryption feature in Cyberduck and Mountain Duck is based on the excellent concepts and work of Cryptomator. Cryptomator is free and open-source software. Since Cyberduck is also open-source software anyone is able to audit the source code. That means no security by obscurity, no hidden backdoors from third parties, no need to trust anyone except yourself.

Compared to other client-side-encryption solutions the Cryptomator based approach yields a few crucial advantages:

  • in addition to file content encryption also file and directory names are encrypted and directory structures obfuscated

  • no online services, no subscriptions, no accounts

  • no need to share your cloud storage provider credentials

Create new Vault

You can create a new Vault directory anywhere on your remote storage. This will initialize the Vault with a masterkey.cryptomator. A backup of the master key file (masterkey.cryptomator) is saved in user defaults. The encrypted keys in masterkey.cryptomator are not more sensitive than the encrypted files in the vault. For technical aspects, refer to Masterkey Derivation.

Choose File → New Vault… to create a new Vault.

Send Command

Unlock Vault

Discovery

When Preferences Cryptomator Auto detect and open vault in browser is enabled, opening a directory in the browser that is a Cryptomator Vault, a prompt is displayed to unlock the Vault using the provided passphrase and decrypt the directory and filenames. If you cancel the prompt, the encrypted Vault content is displayed.

Send Command

Manual

Choose the Cryptomator button in the toolbar or the option in the File menu to unlock and lock a Cryptomator Vault.

Save Passphrase

You can check Add to Keychain to save the passphrase to open the vault with the master key file in your login keychain. The checkbox is disabled by default. Another application that wants to access the Vault passphrase from the login keychain will trigger a permission prompt.

Send Command

Manage your passwords with Keychain Access.app on Mac. Refer to Keychain for Mac: Keychain Access overview.

File Transfers

File transfers require you to unlock the Vault again unless you have chosen to save your Vault passphrase in the keychain.

Browser

You can open and browse multiple Vaults on a server in a single browser window. For each Vault to be opened you will be prompted to enter your passphrase to decrypt the filenames. Decrypted filenames when browsing a Vault will show a padlock overlay icon.

Send Command

Moving Files Into Vault

You can move files from and to the Vault. Because files need to be encrypted or decrypted respectively they pass through your local computer and cannot be moved on the server-side.

Note

The Vault must be unlocked before you move files to it, otherwise the files won’t be encrypted.

Access Vaults on Local Disk

Both Cyberduck and Mountain Duck support browsing your local disk to access Vaults created on your computer. Create a new bookmark to connect to your local disk.

Send Command

In your local disk connection, you can access all directories which are saved on your local disk. This includes for example your local synchronized Dropbox, Google Drive and OneDrive directories.

Access a Cryptomator Vault on local disk on the example of Dropbox

  1. Navigate to the Dropbox directory and open the subdirectories until you reach your Cryptomator Vault.

  2. Double click your vault.

  3. Type your set password in the password box. If you want you can save the password for easier access to this directory for further usage.

Send Command Send Command
  1. Click the Continue button and your Vault should open.

Known Limitations

  • Changing the Vault passphrase is currently not supported.

  • To delete a Vault it cannot be unlocked. Choose Cancel in the vault password prompt to skip unlocking the Vault after selecting the Vault folder for delete.

Security Architecture

See Security Architecture Overview.

Preferences

Auto Detect

Uncheck Preferences → Cryptomator → Auto detect and open Vault in browser to disable opening Vaults by default when opening the Vault directory in the browser.